~ubuntu-branches/ubuntu/oneiric/postgresql-9.1/oneiric-security : contents of doc/src/sgml/html/release-9-1-5.html at revision 14

~ubuntu-branches/ubuntu/oneiric/postgresql-9.1/oneiric-security : (revision 14)
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Release 9.1.5</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REV="MADE"
HREF="mailto:pgsql-docs@postgresql.org"><LINK
REL="HOME"
TITLE="PostgreSQL 9.1.8 Documentation"
HREF="index.html"><LINK
REL="UP"
TITLE="Release Notes"
HREF="release.html"><LINK
REL="PREVIOUS"
TITLE="Release 9.1.6"
HREF="release-9-1-6.html"><LINK
REL="NEXT"
TITLE="Release 9.1.4"
HREF="release-9-1-4.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="stylesheet.css"><META
HTTP-EQUIV="Content-Type"
CONTENT="text/html; charset=ISO-8859-1"><META
NAME="creation"
CONTENT="2013-02-04T21:38:53"></HEAD
><BODY
CLASS="SECT1"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="5"
ALIGN="center"
VALIGN="bottom"
><A
HREF="index.html"
>PostgreSQL 9.1.8 Documentation</A
></TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="top"
><A
TITLE="Release 9.1.6"
HREF="release-9-1-6.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="top"
><A
HREF="release.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="60%"
ALIGN="center"
VALIGN="bottom"
>Appendix E. Release Notes</TD
><TD
WIDTH="20%"
ALIGN="right"
VALIGN="top"
><A
TITLE="Release 9.1.4"
HREF="release-9-1-4.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="RELEASE-9-1-5"
>E.4. Release 9.1.5</A
></H1
><DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Release Date: </B
>2012-08-17</P
></BLOCKQUOTE
></DIV
><P
>   This release contains a variety of fixes from 9.1.4.
   For information about new features in the 9.1 major release, see
   <A
HREF="release-9-1.html"
>Section E.9</A
>.
  </P
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN106998"
>E.4.1. Migration to Version 9.1.5</A
></H2
><P
>    A dump/restore is not required for those running 9.1.X.
   </P
><P
>    However, if you are upgrading from a version earlier than 9.1.4,
    see the release notes for 9.1.4.
   </P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN107002"
>E.4.2. Changes</A
></H2
><P
></P
><UL
><LI
><P
>      Prevent access to external files/URLs via XML entity references
      (Noah Misch, Tom Lane)
     </P
><P
>      <CODE
CLASS="FUNCTION"
>xml_parse()</CODE
> would attempt to fetch external files or
      URLs as needed to resolve DTD and entity references in an XML value,
      thus allowing unprivileged database users to attempt to fetch data
      with the privileges of the database server.  While the external data
      wouldn't get returned directly to the user, portions of it could be
      exposed in error messages if the data didn't parse as valid XML; and
      in any case the mere ability to check existence of a file might be
      useful to an attacker.  (CVE-2012-3489)
     </P
></LI
><LI
><P
>      Prevent access to external files/URLs via <TT
CLASS="FILENAME"
>contrib/xml2</TT
>'s
      <CODE
CLASS="FUNCTION"
>xslt_process()</CODE
> (Peter Eisentraut)
     </P
><P
>      <SPAN
CLASS="APPLICATION"
>libxslt</SPAN
> offers the ability to read and write both
      files and URLs through stylesheet commands, thus allowing
      unprivileged database users to both read and write data with the
      privileges of the database server.  Disable that through proper use
      of <SPAN
CLASS="APPLICATION"
>libxslt</SPAN
>'s security options.  (CVE-2012-3488)
     </P
><P
>      Also, remove <CODE
CLASS="FUNCTION"
>xslt_process()</CODE
>'s ability to fetch documents
      and stylesheets from external files/URLs.  While this was a
      documented <SPAN
CLASS="QUOTE"
>"feature"</SPAN
>, it was long regarded as a bad idea.
      The fix for CVE-2012-3489 broke that capability, and rather than
      expend effort on trying to fix it, we're just going to summarily
      remove it.
     </P
></LI
><LI
><P
>      Prevent too-early recycling of btree index pages (Noah Misch)
     </P
><P
>      When we allowed read-only transactions to skip assigning XIDs, we
      introduced the possibility that a deleted btree page could be
      recycled while a read-only transaction was still in flight to it.
      This would result in incorrect index search results.  The probability
      of such an error occurring in the field seems very low because of the
      timing requirements, but nonetheless it should be fixed.
     </P
></LI
><LI
><P
>      Fix crash-safety bug with newly-created-or-reset sequences (Tom Lane)
     </P
><P
>      If <TT
CLASS="COMMAND"
>ALTER SEQUENCE</TT
> was executed on a freshly created or
      reset sequence, and then precisely one <CODE
CLASS="FUNCTION"
>nextval()</CODE
> call
      was made on it, and then the server crashed, WAL replay would restore
      the sequence to a state in which it appeared that no
      <CODE
CLASS="FUNCTION"
>nextval()</CODE
> had been done, thus allowing the first
      sequence value to be returned again by the next
      <CODE
CLASS="FUNCTION"
>nextval()</CODE
> call.  In particular this could manifest for
      <TT
CLASS="TYPE"
>serial</TT
> columns, since creation of a serial column's sequence
      includes an <TT
CLASS="COMMAND"
>ALTER SEQUENCE OWNED BY</TT
> step.
     </P
></LI
><LI
><P
>      Fix race condition in <TT
CLASS="LITERAL"
>enum</TT
>-type value comparisons (Robert
      Haas, Tom Lane)
     </P
><P
>      Comparisons could fail when encountering an enum value added since
      the current query started.
     </P
></LI
><LI
><P
>      Fix <CODE
CLASS="FUNCTION"
>txid_current()</CODE
> to report the correct epoch when not
      in hot standby (Heikki Linnakangas)
     </P
><P
>      This fixes a regression introduced in the previous minor release.
     </P
></LI
><LI
><P
>      Prevent selection of unsuitable replication connections as
      the synchronous standby (Fujii Masao)
     </P
><P
>      The master might improperly choose pseudo-servers such as
      <SPAN
CLASS="APPLICATION"
>pg_receivexlog</SPAN
> or <SPAN
CLASS="APPLICATION"
>pg_basebackup</SPAN
>
      as the synchronous standby, and then wait indefinitely for them.
     </P
></LI
><LI
><P
>      Fix bug in startup of Hot Standby when a master transaction has many
      subtransactions (Andres Freund)
     </P
><P
>      This mistake led to failures reported as <SPAN
CLASS="QUOTE"
>"out-of-order XID
      insertion in KnownAssignedXids"</SPAN
>.
     </P
></LI
><LI
><P
>      Ensure the <TT
CLASS="FILENAME"
>backup_label</TT
> file is fsync'd after
      <CODE
CLASS="FUNCTION"
>pg_start_backup()</CODE
> (Dave Kerr)
     </P
></LI
><LI
><P
>      Fix timeout handling in walsender processes (Tom Lane)
     </P
><P
>      WAL sender background processes neglected to establish a
      <SPAN
CLASS="SYSTEMITEM"
>SIGALRM</SPAN
> handler, meaning they would wait forever in
      some corner cases where a timeout ought to happen.
     </P
></LI
><LI
><P
>      Wake walsenders after each background flush by walwriter (Andres
      Freund, Simon Riggs)
     </P
><P
>      This greatly reduces replication delay when the workload contains
      only asynchronously-committed transactions.
     </P
></LI
><LI
><P
>      Fix <TT
CLASS="LITERAL"
>LISTEN</TT
>/<TT
CLASS="LITERAL"
>NOTIFY</TT
> to cope better with I/O
      problems, such as out of disk space (Tom Lane)
     </P
><P
>      After a write failure, all subsequent attempts to send more
      <TT
CLASS="LITERAL"
>NOTIFY</TT
> messages would fail with messages like
      <SPAN
CLASS="QUOTE"
>"Could not read from file "pg_notify/<TT
CLASS="REPLACEABLE"
><I
>nnnn</I
></TT
>" at
      offset <TT
CLASS="REPLACEABLE"
><I
>nnnnn</I
></TT
>: Success"</SPAN
>.
     </P
></LI
><LI
><P
>      Only allow autovacuum to be auto-canceled by a directly blocked
      process (Tom Lane)
     </P
><P
>      The original coding could allow inconsistent behavior in some cases;
      in particular, an autovacuum could get canceled after less than
      <TT
CLASS="LITERAL"
>deadlock_timeout</TT
> grace period.
     </P
></LI
><LI
><P
>      Improve logging of autovacuum cancels (Robert Haas)
     </P
></LI
><LI
><P
>      Fix log collector so that <TT
CLASS="LITERAL"
>log_truncate_on_rotation</TT
> works
      during the very first log rotation after server start (Tom Lane)
     </P
></LI
><LI
><P
>      Fix <TT
CLASS="LITERAL"
>WITH</TT
> attached to a nested set operation
      (<TT
CLASS="LITERAL"
>UNION</TT
>/<TT
CLASS="LITERAL"
>INTERSECT</TT
>/<TT
CLASS="LITERAL"
>EXCEPT</TT
>)
      (Tom Lane)
     </P
></LI
><LI
><P
>      Ensure that a whole-row reference to a subquery doesn't include any
      extra <TT
CLASS="LITERAL"
>GROUP BY</TT
> or <TT
CLASS="LITERAL"
>ORDER BY</TT
> columns (Tom Lane)
     </P
></LI
><LI
><P
>      Fix dependencies generated during <TT
CLASS="LITERAL"
>ALTER TABLE ... ADD
      CONSTRAINT USING INDEX</TT
> (Tom Lane)
     </P
><P
>      This command left behind a redundant <TT
CLASS="STRUCTNAME"
>pg_depend</TT
> entry
      for the index, which could confuse later operations, notably
      <TT
CLASS="LITERAL"
>ALTER TABLE ... ALTER COLUMN TYPE</TT
> on one of the indexed
      columns.
     </P
></LI
><LI
><P
>      Fix <TT
CLASS="COMMAND"
>REASSIGN OWNED</TT
> to work on extensions (Alvaro Herrera)
     </P
></LI
><LI
><P
>      Disallow copying whole-row references in <TT
CLASS="LITERAL"
>CHECK</TT
>
      constraints and index definitions during <TT
CLASS="COMMAND"
>CREATE TABLE</TT
>
      (Tom Lane)
     </P
><P
>      This situation can arise in <TT
CLASS="COMMAND"
>CREATE TABLE</TT
> with
      <TT
CLASS="LITERAL"
>LIKE</TT
> or <TT
CLASS="LITERAL"
>INHERITS</TT
>.  The copied whole-row
      variable was incorrectly labeled with the row type of the original
      table not the new one.  Rejecting the case seems reasonable for
      <TT
CLASS="LITERAL"
>LIKE</TT
>, since the row types might well diverge later.  For
      <TT
CLASS="LITERAL"
>INHERITS</TT
> we should ideally allow it, with an implicit
      coercion to the parent table's row type; but that will require more
      work than seems safe to back-patch.
     </P
></LI
><LI
><P
>      Fix memory leak in <TT
CLASS="LITERAL"
>ARRAY(SELECT ...)</TT
> subqueries (Heikki
      Linnakangas, Tom Lane)
     </P
></LI
><LI
><P
>      Fix planner to pass correct collation to operator selectivity
      estimators (Tom Lane)
     </P
><P
>      This was not previously required by any core selectivity estimation
      function, but third-party code might need it.
     </P
></LI
><LI
><P
>      Fix extraction of common prefixes from regular expressions (Tom Lane)
     </P
><P
>      The code could get confused by quantified parenthesized
      subexpressions, such as <TT
CLASS="LITERAL"
>^(foo)?bar</TT
>.  This would lead to
      incorrect index optimization of searches for such patterns.
     </P
></LI
><LI
><P
>      Fix bugs with parsing signed
      <TT
CLASS="REPLACEABLE"
><I
>hh</I
></TT
><TT
CLASS="LITERAL"
>:</TT
><TT
CLASS="REPLACEABLE"
><I
>mm</I
></TT
> and
      <TT
CLASS="REPLACEABLE"
><I
>hh</I
></TT
><TT
CLASS="LITERAL"
>:</TT
><TT
CLASS="REPLACEABLE"
><I
>mm</I
></TT
><TT
CLASS="LITERAL"
>:</TT
><TT
CLASS="REPLACEABLE"
><I
>ss</I
></TT
>
      fields in <TT
CLASS="TYPE"
>interval</TT
> constants (Amit Kapila, Tom Lane)
     </P
></LI
><LI
><P
>      Fix <SPAN
CLASS="APPLICATION"
>pg_dump</SPAN
> to better handle views containing partial
      <TT
CLASS="LITERAL"
>GROUP BY</TT
> lists (Tom Lane)
     </P
><P
>      A view that lists only a primary key column in <TT
CLASS="LITERAL"
>GROUP BY</TT
>,
      but uses other table columns as if they were grouped, gets marked as
      depending on the primary key.  Improper handling of such primary key
      dependencies in <SPAN
CLASS="APPLICATION"
>pg_dump</SPAN
> resulted in poorly-ordered
      dumps, which at best would be inefficient to restore and at worst
      could result in outright failure of a parallel
      <SPAN
CLASS="APPLICATION"
>pg_restore</SPAN
> run.
     </P
></LI
><LI
><P
>      In PL/Perl, avoid setting UTF8 flag when in SQL_ASCII encoding
      (Alex Hunsaker, Kyotaro Horiguchi, Alvaro Herrera)
     </P
></LI
><LI
><P
>      Use Postgres' encoding conversion functions, not Python's, when
      converting a Python Unicode string to the server encoding in
      PL/Python (Jan Urbanski)
     </P
><P
>      This avoids some corner-case problems, notably that Python doesn't
      support all the encodings Postgres does.  A notable functional change
      is that if the server encoding is SQL_ASCII, you will get the UTF-8
      representation of the string; formerly, any non-ASCII characters in
      the string would result in an error.
     </P
></LI
><LI
><P
>      Fix mapping of PostgreSQL encodings to Python encodings in PL/Python
      (Jan Urbanski)
     </P
></LI
><LI
><P
>      Report errors properly in <TT
CLASS="FILENAME"
>contrib/xml2</TT
>'s
      <CODE
CLASS="FUNCTION"
>xslt_process()</CODE
> (Tom Lane)
     </P
></LI
><LI
><P
>      Update time zone data files to <SPAN
CLASS="APPLICATION"
>tzdata</SPAN
> release 2012e
      for DST law changes in Morocco and Tokelau
     </P
></LI
></UL
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="release-9-1-6.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="release-9-1-4.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Release 9.1.6</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="release.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Release 9.1.4</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>